From da8ec0ba1bd713bd01926a2db9464b4b1d2fe96e Mon Sep 17 00:00:00 2001
From: Kevin Ressegaire <176156975+earzalien@users.noreply.github.com>
Date: Sun, 22 Mar 2026 11:56:41 +0100
Subject: [PATCH 1/4] feat: add invitation email option

---
 client/src/pages/TripInvitation.tsx           | 31 +++++--
 client/src/pages/styles/TripInvitation.css    | 13 +++
 package-lock.json                             | 83 +++++++++++++++++--
 server/.env.sample                            |  4 +
 server/package.json                           |  3 +-
 server/src/libs/resend.ts                     |  5 ++
 .../modules/invitation/invitationActions.ts   | 25 +++++-
 7 files changed, 151 insertions(+), 13 deletions(-)
 create mode 100644 server/src/libs/resend.ts

diff --git a/client/src/pages/TripInvitation.tsx b/client/src/pages/TripInvitation.tsx
index 91eb18a..37e325e 100644
--- a/client/src/pages/TripInvitation.tsx
+++ b/client/src/pages/TripInvitation.tsx
@@ -35,7 +35,7 @@ function TripInvitation({
     email: "",
     message: "",
   });
-
+  const [copyLink, setCopyLink] = useState(false);
   const [loading, setLoading] = useState(false);
 
   const formatDate = (dateString: string) => {
@@ -62,6 +62,7 @@ function TripInvitation({
 
   const cancelInvitation = (e: React.MouseEvent<HTMLButtonElement>) => {
     setInvitationForm({ email: "", message: "" });
+    setCopyLink(false);
     if (onClose) onClose(e);
   };
 
@@ -74,7 +75,7 @@ function TripInvitation({
   const copyToClipboard = async (text: string) => {
     try {
       await navigator.clipboard.writeText(text);
-      toast.success("Lien d’invitation copié 📋");
+      toast.success("Lien d'invitation copié");
     } catch {
       toast.error("Impossible de copier le lien");
     }
@@ -100,8 +101,13 @@ function TripInvitation({
         throw new Error(data.error || "Erreur lors de l'envoi");
       }
 
-      await copyToClipboard(data.invitationLink);
+      if (copyLink) {
+        await copyToClipboard(data.invitationLink);
+        toast.success("Email envoyé avec succès");
+      }
+
       setInvitationForm({ email: "", message: "" });
+      setCopyLink(false);
     } catch {
       toast.error("Erreur lors de l'envoi de l'invitation");
     } finally {
@@ -120,7 +126,6 @@ function TripInvitation({
       }}
       aria-modal="true"
     >
-
       <ToastContainer position="top-right" autoClose={3000} theme="light" />
       <article className="tripinvitation-invitation-form">
         <div className="tripinvitation-head">
@@ -162,6 +167,7 @@ function TripInvitation({
               onChange={updateInvitationForm}
               required
               placeholder="adresse@email.com"
+              disabled={loading}
             />
           </label>
 
@@ -172,15 +178,28 @@ function TripInvitation({
               value={invitationForm.message}
               onChange={updateInvitationForm}
               placeholder="Ajoutez un message personnalisé..."
+              disabled={loading}
             />
           </label>
 
+          <label>
+            <div className="tripinvitation-copy-checkbox">
+            <input
+              type="checkbox"
+              checked={copyLink}
+              onChange={(e) => setCopyLink(e.target.checked)}
+              disabled={loading}
+            />
+            Copier aussi le lien d'invitation
+            </div>
+          </label>
+
           <button
             type="submit"
             className="tripinvitation-btn-send-invitation"
-            disabled={loading}
+            disabled={loading || !invitationForm.email}
           >
-            {loading ? "Copie..." : "Copier le lien d'invitation"}
+            {loading ? "Envoi..." : "Envoyer par email"}
           </button>
 
           <button
diff --git a/client/src/pages/styles/TripInvitation.css b/client/src/pages/styles/TripInvitation.css
index c609982..779007b 100644
--- a/client/src/pages/styles/TripInvitation.css
+++ b/client/src/pages/styles/TripInvitation.css
@@ -143,6 +143,19 @@
 .tripinvitation-btn-cancel-invitation:hover {
   background: #f3f4f6;
 }
+.tripinvitation-copy-checkbox {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.5rem;
+  font-size: 0.9rem;
+  color: #666;
+  margin-bottom: 1rem;
+}
+
+.tripinvitation-copy-checkbox input[type="checkbox"] {
+  margin-top: 0.05rem;
+  flex-shrink: 0;
+}
 
 @media (max-width: 768px) {
   .tripinvitation-invitation-form {
diff --git a/package-lock.json b/package-lock.json
index 129450b..34877cc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
-  "name": "p3-remote-vert-triptogether",
-  "version": "0.0.1",
+  "name": "triptogether",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "p3-remote-vert-triptogether",
-      "version": "0.0.1",
+      "name": "triptogether",
+      "version": "1.0.0",
       "license": "MIT",
       "workspaces": [
         "client",
@@ -2605,6 +2605,12 @@
         "@sinonjs/commons": "^3.0.0"
       }
     },
+    "node_modules/@stablelib/base64": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.1.tgz",
+      "integrity": "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==",
+      "license": "MIT"
+    },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
@@ -4452,6 +4458,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-sha256": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/fast-sha256/-/fast-sha256-1.3.0.tgz",
+      "integrity": "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==",
+      "license": "Unlicense"
+    },
     "node_modules/fast-uri": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
@@ -7299,6 +7311,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/postal-mime": {
+      "version": "2.7.3",
+      "resolved": "https://registry.npmjs.org/postal-mime/-/postal-mime-2.7.3.tgz",
+      "integrity": "sha512-MjhXadAJaWgYzevi46+3kLak8y6gbg0ku14O1gO/LNOuay8dO+1PtcSGvAdgDR0DoIsSaiIA8y/Ddw6MnrO0Tw==",
+      "license": "MIT-0"
+    },
     "node_modules/postcss": {
       "version": "8.5.6",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
@@ -7545,6 +7563,27 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/resend": {
+      "version": "6.9.4",
+      "resolved": "https://registry.npmjs.org/resend/-/resend-6.9.4.tgz",
+      "integrity": "sha512-/M3dsJzu5OgozqVsA4Psd/1L7EdePgOIIxClas453GOQYFG3VHc2ZyCHZFlvqsc9aZCCd2BJRRqZgWC8D9c7/g==",
+      "license": "MIT",
+      "dependencies": {
+        "postal-mime": "2.7.3",
+        "svix": "1.86.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "@react-email/render": "*"
+      },
+      "peerDependenciesMeta": {
+        "@react-email/render": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/resolve": {
       "version": "1.22.11",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
@@ -7980,6 +8019,16 @@
         "node": ">=10"
       }
     },
+    "node_modules/standardwebhooks": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
+      "integrity": "sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==",
+      "license": "MIT",
+      "dependencies": {
+        "@stablelib/base64": "^1.0.0",
+        "fast-sha256": "^1.3.0"
+      }
+    },
     "node_modules/statuses": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
@@ -8161,6 +8210,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/svix": {
+      "version": "1.86.0",
+      "resolved": "https://registry.npmjs.org/svix/-/svix-1.86.0.tgz",
+      "integrity": "sha512-/HTvXwjLJe1l/MsLXAO1ddCYxElJk4eNR4DzOjDOEmGrPN/3BtBE8perGwMAaJ2sT5T172VkBYzmHcjUfM1JRQ==",
+      "license": "MIT",
+      "dependencies": {
+        "standardwebhooks": "1.0.0",
+        "uuid": "^10.0.0"
+      }
+    },
     "node_modules/test-exclude": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
@@ -8518,6 +8577,19 @@
         "node": ">= 0.4.0"
       }
     },
+    "node_modules/uuid": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
+      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
     "node_modules/v8-to-istanbul": {
       "version": "9.3.0",
       "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz",
@@ -9315,7 +9387,8 @@
         "joi": "^18.0.2",
         "jsonwebtoken": "^9.0.3",
         "mysql2": "^3.16.0",
-        "react-toastify": "^11.0.5"
+        "react-toastify": "^11.0.5",
+        "resend": "^6.9.4"
       },
       "devDependencies": {
         "@faker-js/faker": "^9.6.0",
diff --git a/server/.env.sample b/server/.env.sample
index 1c9d391..3c0b611 100644
--- a/server/.env.sample
+++ b/server/.env.sample
@@ -16,6 +16,10 @@ CLIENT_URL=http://localhost:3000
 
 GOOGLE_API_KEY=YOUR_API_KEY
 
+RESEND_API_KEY=YOUR_API_KEY
+RESEND_FROM="YOUR NAME <NAME@DOMAIN.com>"
+
+
 # About specific needs, please ask your trainer about the deploiement project name and follow the pattern
 # You can add as much variable as needed. Don't forget to tell your trainer about it. Otherwise, it could break on deploiement
 PROJECT_NAME_SPECIFIC_NAME=YOUR_SPECIFIC_VALUE
diff --git a/server/package.json b/server/package.json
index 53d8bb6..cd1898b 100644
--- a/server/package.json
+++ b/server/package.json
@@ -18,7 +18,8 @@
     "joi": "^18.0.2",
     "jsonwebtoken": "^9.0.3",
     "mysql2": "^3.16.0",
-    "react-toastify": "^11.0.5"
+    "react-toastify": "^11.0.5",
+    "resend": "^6.9.4"
   },
   "devDependencies": {
     "@faker-js/faker": "^9.6.0",
diff --git a/server/src/libs/resend.ts b/server/src/libs/resend.ts
new file mode 100644
index 0000000..062f2c7
--- /dev/null
+++ b/server/src/libs/resend.ts
@@ -0,0 +1,5 @@
+import { Resend } from "resend";
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+export default resend;
\ No newline at end of file
diff --git a/server/src/modules/invitation/invitationActions.ts b/server/src/modules/invitation/invitationActions.ts
index 8c1b03a..2b1a396 100644
--- a/server/src/modules/invitation/invitationActions.ts
+++ b/server/src/modules/invitation/invitationActions.ts
@@ -2,6 +2,7 @@ import type { RequestHandler } from "express";
 import tripRepository from "../trip/tripRepository";
 import userRepository from "../user/userRepository";
 import invitationRepository from "./invitationRepository";
+import resend from "../../libs/resend";
 
 const read: RequestHandler = async (req, res, next) => {
   try {
@@ -110,7 +111,29 @@ const add: RequestHandler = async (req, res, next) => {
 
     const invitationLink = `${clientUrl}/trip/${tripId}/invitation/${invitationId}`;
 
-    res.status(201).json({ invitationLink });
+    const { data, error } = await resend.emails.send({
+      from: process.env.RESEND_FROM as string,
+      to: email,
+      subject: "Invitation à rejoindre un voyage sur TripTogether",
+      html: `
+        <p>Bonjour,</p>
+        <p>Vous avez reçu une invitation à rejoindre un voyage sur TripTogether.</p>
+        <p>Message :</p>
+        <blockquote>${message}</blockquote>
+        <p>Pour voir l'invitation et répondre, cliquez sur le lien ci-dessous :</p>
+        <p><a href="${invitationLink}">${invitationLink}</a></p>
+        <p>À bientôt sur TripTogether !</p>
+      `,
+    });
+
+    if (error) {
+      // à toi de voir : soit tu lances une erreur, soit tu continues mais tu logs
+      console.error("Erreur envoi email invitation:", error);
+      // Option 1 : throw error pour que le front sache que l’email n’est pas parti
+      // throw new Error("Erreur lors de l'envoi de l'email d'invitation");
+    }
+
+    res.status(201).json({ invitationLink, emailSent: !error, emailData: data });
   } catch (err) {
     next(err);
   }

From b9ba61bb4cfdd0cce74b5f792bb061bb31d14957 Mon Sep 17 00:00:00 2001
From: Kevin Ressegaire <176156975+earzalien@users.noreply.github.com>
Date: Sun, 22 Mar 2026 16:31:13 +0100
Subject: [PATCH 2/4] fix: ensure invitation success toast

---
 client/src/pages/TripInvitation.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/client/src/pages/TripInvitation.tsx b/client/src/pages/TripInvitation.tsx
index 37e325e..0b99b5e 100644
--- a/client/src/pages/TripInvitation.tsx
+++ b/client/src/pages/TripInvitation.tsx
@@ -103,9 +103,10 @@ function TripInvitation({
 
       if (copyLink) {
         await copyToClipboard(data.invitationLink);
-        toast.success("Email envoyé avec succès");
       }
 
+      toast.success("Email envoyé avec succès");
+
       setInvitationForm({ email: "", message: "" });
       setCopyLink(false);
     } catch {
@@ -115,6 +116,7 @@ function TripInvitation({
     }
   };
 
+
   return (
     <section
       className="tripinvitation-overlay"

From 657716d559b441979a94ee6d1492c2fd0f3ad1ba Mon Sep 17 00:00:00 2001
From: Kevin Ressegaire <176156975+earzalien@users.noreply.github.com>
Date: Sun, 22 Mar 2026 16:40:45 +0100
Subject: [PATCH 3/4] fix: validate resend api key and escape invitation
 message

---
 server/src/libs/resend.ts                     | 10 ++++--
 .../modules/invitation/invitationActions.ts   | 31 ++++++++++++-------
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/server/src/libs/resend.ts b/server/src/libs/resend.ts
index 062f2c7..86c9aac 100644
--- a/server/src/libs/resend.ts
+++ b/server/src/libs/resend.ts
@@ -1,5 +1,11 @@
 import { Resend } from "resend";
 
-const resend = new Resend(process.env.RESEND_API_KEY);
+const apiKey = process.env.RESEND_API_KEY;
 
-export default resend;
\ No newline at end of file
+if (!apiKey) {
+    throw new Error("RESEND_API_KEY environment variable is not defined");
+}
+
+const resend = new Resend(apiKey);
+
+export default resend;
diff --git a/server/src/modules/invitation/invitationActions.ts b/server/src/modules/invitation/invitationActions.ts
index 2b1a396..21d435f 100644
--- a/server/src/modules/invitation/invitationActions.ts
+++ b/server/src/modules/invitation/invitationActions.ts
@@ -110,27 +110,34 @@ const add: RequestHandler = async (req, res, next) => {
     }
 
     const invitationLink = `${clientUrl}/trip/${tripId}/invitation/${invitationId}`;
+    
+    const escapeHtml = (unsafe: string) =>
+      unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
+
+    const safeMessage = escapeHtml(message);
 
     const { data, error } = await resend.emails.send({
       from: process.env.RESEND_FROM as string,
       to: email,
       subject: "Invitation à rejoindre un voyage sur TripTogether",
       html: `
-        <p>Bonjour,</p>
-        <p>Vous avez reçu une invitation à rejoindre un voyage sur TripTogether.</p>
-        <p>Message :</p>
-        <blockquote>${message}</blockquote>
-        <p>Pour voir l'invitation et répondre, cliquez sur le lien ci-dessous :</p>
-        <p><a href="${invitationLink}">${invitationLink}</a></p>
-        <p>À bientôt sur TripTogether !</p>
-      `,
+    <p>Bonjour,</p>
+    <p>Vous avez reçu une invitation à rejoindre un voyage sur TripTogether.</p>
+    <p>Message :</p>
+    <blockquote>${safeMessage}</blockquote>
+    <p>Pour voir l'invitation et répondre, cliquez sur le lien ci-dessous :</p>
+    <p><a href="${invitationLink}">${invitationLink}</a></p>
+    <p>À bientôt sur TripTogether !</p>
+  `,
     });
 
     if (error) {
-      // à toi de voir : soit tu lances une erreur, soit tu continues mais tu logs
-      console.error("Erreur envoi email invitation:", error);
-      // Option 1 : throw error pour que le front sache que l’email n’est pas parti
-      // throw new Error("Erreur lors de l'envoi de l'email d'invitation");
+      throw new Error("Erreur lors de l'envoi de l'email d'invitation");
     }
 
     res.status(201).json({ invitationLink, emailSent: !error, emailData: data });

From 5b614d359d6fda8c6a2166f68b7508c1e1c05c13 Mon Sep 17 00:00:00 2001
From: Kevin Ressegaire <176156975+earzalien@users.noreply.github.com>
Date: Sun, 22 Mar 2026 16:47:25 +0100
Subject: [PATCH 4/4] fix: validate resend api key and escape invitation
 message

---
 server/src/modules/invitation/invitationActions.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/modules/invitation/invitationActions.ts b/server/src/modules/invitation/invitationActions.ts
index 21d435f..4d1469e 100644
--- a/server/src/modules/invitation/invitationActions.ts
+++ b/server/src/modules/invitation/invitationActions.ts
@@ -137,7 +137,7 @@ const add: RequestHandler = async (req, res, next) => {
     });
 
     if (error) {
-      throw new Error("Erreur lors de l'envoi de l'email d'invitation");
+      console.error("Erreur envoi email invitation:", error);
     }
 
     res.status(201).json({ invitationLink, emailSent: !error, emailData: data });